0

I know we can grab the user's session ID in apex by using UserInfo.getSessionID() but what limitations are there as to what rest endpoints it can use and also is there any way for me externally to verify the token as to whether it is a valid token and the username/userid of the token.

Improve this question

1 Answer 1

Reset to default
0

The Session ID is limited to whatever the parent session is limited to. For example, using the REST API, you'd have access to whatever APIs are within the scope of the OAuth session that was authorized, while in Lightning, you'd be limited to just the UI API methods, as the Lightning Session ID doesn't include REST or SOAP API access.

Improve this answer
3
  • is there any way to check what the scope of the Session ID is?
    – KarlLivesey
    Apr 19, 2022 at 13:15
  • this is more so I can run tests and see what scopes I get from what.
    – KarlLivesey
    Apr 19, 2022 at 13:35
  • @KarlLivesey the only properties in aware of are in the Auth session object. You do get to know what kind of session you're using, but not specific properties like the OAuth scope, which is only relevant for OAuth login flows. You have to basically call the API and see what response you get.
    – sfdcfox
    Apr 19, 2022 at 13:52

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .